Commit bb986a50 authored by Ahmed Abdelsalam's avatar Ahmed Abdelsalam Committed by David S. Miller
Browse files

seg6: fix seg6_validate_srh() to avoid slab-out-of-bounds 



The seg6_validate_srh() is used to validate SRH for three cases:

case1: SRH of data-plane SRv6 packets to be processed by the Linux kernel.
Case2: SRH of the netlink message received  from user-space (iproute2)
Case3: SRH injected into packets through setsockopt

In case1, the SRH can be encoded in the Reduced way (i.e., first SID is
carried in DA only and not represented as SID in the SRH) and the
seg6_validate_srh() now handles this case correctly.

In case2 and case3, the SRH shouldn’t be encoded in the Reduced way
otherwise we lose the first segment (i.e., the first hop).

The current implementation of the seg6_validate_srh() allow SRH of case2
and case3 to be encoded in the Reduced way. This leads a slab-out-of-bounds
problem.

This patch verifies SRH of case1, case2 and case3. Allowing case1 to be
reduced while preventing SRH of case2 and case3 from being reduced .

Reported-by: default avatar <syzbot+e8c028b62439eac42073@syzkaller.appspotmail.com>
Reported-by: default avatarYueHaibing <yuehaibing@huawei.com>
Fixes: 0cb7498f ("seg6: fix SRH processing to comply with RFC8754")
Signed-off-by: default avatarAhmed Abdelsalam <ahabdels@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5e9eeccc

include/net/seg6.h

+1 −1
Original line number Diff line number Diff line
@@ -57,7 +57,7 @@ extern void seg6_iptunnel_exit(void); 
extern int seg6_local_init(void);

extern void seg6_local_exit(void);



extern bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len);

extern bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len, bool reduced);

extern int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh,

			     int proto);

extern int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh);

net/core/filter.c

+1 −1
Original line number Diff line number Diff line
@@ -5050,7 +5050,7 @@ static int bpf_push_seg6_encap(struct sk_buff *skb, u32 type, void *hdr, u32 len 
	int err;

	struct ipv6_sr_hdr *srh = (struct ipv6_sr_hdr *)hdr;



	if (!seg6_validate_srh(srh, len))

	if (!seg6_validate_srh(srh, len, false))

		return -EINVAL;



	switch (type) {

net/ipv6/ipv6_sockglue.c

+1 −1
Original line number Diff line number Diff line
@@ -493,7 +493,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, 
				struct ipv6_sr_hdr *srh = (struct ipv6_sr_hdr *)

							  opt->srcrt;



				if (!seg6_validate_srh(srh, optlen))

				if (!seg6_validate_srh(srh, optlen, false))

					goto sticky_done;

				break;

			}

net/ipv6/seg6.c

+10 −6
Original line number Diff line number Diff line
@@ -25,7 +25,7 @@ 
#include <net/seg6_hmac.h>

#endif



bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len)

bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len, bool reduced)

{

	unsigned int tlv_offset;

	int max_last_entry;
@@ -37,6 +37,9 @@ bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len) 
	if (((srh->hdrlen + 1) << 3) != len)

		return false;



	if (!reduced && srh->segments_left > srh->first_segment) {

		return false;

	} else {

		max_last_entry = (srh->hdrlen / 2) - 1;



		if (srh->first_segment > max_last_entry)
@@ -44,6 +47,7 @@ bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len) 


		if (srh->segments_left > srh->first_segment + 1)

			return false;

	}



	tlv_offset = sizeof(*srh) + ((srh->first_segment + 1) << 4);

net/ipv6/seg6_iptunnel.c

+1 −1
Original line number Diff line number Diff line
@@ -426,7 +426,7 @@ static int seg6_build_state(struct net *net, struct nlattr *nla, 
	}



	/* verify that SRH is consistent */

	if (!seg6_validate_srh(tuninfo->srh, tuninfo_len - sizeof(*tuninfo)))

	if (!seg6_validate_srh(tuninfo->srh, tuninfo_len - sizeof(*tuninfo), false))

		return -EINVAL;



	newts = lwtunnel_state_alloc(tuninfo_len + sizeof(*slwt));

CRA Git | Maintained and supported by SUSTech CRA and CCSE